Live › vulnerability › CVE-2026-121402
FreeRDP before 3.32.2 has a NULL pointer dereference that lets a malicious RDP server crash the xfreerdp client. A zero-width RDPGFX ResetGraphics message leaves the display null, and a later bitmap update crashes the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams that run xfreerdp or build apps on FreeRDP to connect to remote desktops are exposed when they connect to an RDP server they do not trust. The risk is a client crash (denial of service) rather than code execution. Teams that only use managed RDP endpoints they control can deprioritise it.
No product ranges from the sources yet.
xfreerdp --version3.32.2 in your packages or bundled binaries3.32.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.
This page as .md · .json · in your agent: get_signal("CVE-2026-121402")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.